[RonaldHensbergen]

Closes #76.

Renderer unit tests (tests/test_k8s_renderer.py, test_k8s_runner.py, test_k8s_security.py) and the k3d E2E harness already existed; the missing piece was CI. Per the 2026-10-25 note on the issue, this reuses the documented k3d harness instead of adding a parallel kind setup.

• New .github/workflows/k8s-e2e.yml: builds local images, runs make k3d-e2e (cluster, cds up --target helm, all workloads Ready, Postgres/Dagster/Superset checks), uploads diagnostics on failure, always runs make k3d-down.
• k3d v5.9.0 pinned and sha256-verified.
• tests/test_k8s_e2e_workflow.py pins the workflow's key invariants; docs and CHANGELOG updated.

Verified locally: full suite 1934 OK, yamllint/markdownlint/ruff pass. k3d/helm are not installed locally, so the workflow itself is first exercised by this PR's run.

[RonaldHensbergen]

Review

Independently verified:

• k3d pin: downloaded the v5.9.0 k3d-linux-amd64 release binary and hashed it — 06d8f25bc3a971c4eb29e0ff08429b180402db0f4dec838c9eac427e296800a0 matches the pinned SHA256.
• Env coverage: all nine CDS_* variables required by profiles/local-dagster-postgres-superset/profile.yaml are supplied in the workflow env.
• Diagnostics wiring: the failure() step sources k3d-env.sh and uses ${CDS_NAMESPACE}-e2e, matching the namespace e2e.sh derives. CDS_E2E_KEEP_CLUSTER=1 correctly skips e2e.sh's cleanup so the cluster survives for diagnostics, and the always() make k3d-down step deletes it afterwards — the two settings are coherent.
• venv contract: pip install . into .venv matches what install.sh (${CDS_REPO_ROOT}/.venv/bin/cds) and e2e.sh (.venv/bin/python) expect. Python 3.14 matches requires-python = ">=3.14".
• postgres image consistency: the helm target renders production variants (cli/k8s_renderer.py sets is_production=True), so the postgres workload uses local/postgres:custom with imagePullPolicy: Never — building and importing it in build-images.sh/k3d-env.sh is required and now consistent.
• Ran tests/test_k8s_e2e_workflow.py + tests/test_k3d_e2e_profile.py locally: 7 passed.

Issue

• tests/test_k3d_e2e_profile.py: the new K3dLocalImagesTest class is defined after the if __name__ == "__main__": unittest.main() block. Under pytest it is collected, but executing the file directly (python tests/test_k3d_e2e_profile.py) runs unittest.main() before the class exists, so the test silently never runs that way. Please move the class above the __main__ block.

Nits (non-blocking)

• The path filters omit Makefile — changes to the k3d-* targets there won't trigger this workflow. pyproject.toml (CLI entry points) is also outside the filters.
• cancel-in-progress: true also cancels a running main-branch E2E run when a new push lands; that is reasonable, just noting the behavior.

Otherwise this looks good: the workflow reuses the documented harness rather than adding a parallel setup, pins and verifies k3d, and the invariants are pinned by tests. All checks green including the E2E job itself (4m13s).

[RonaldHensbergen]

Addressed the review comments in 1166193: the test class moved above the __main__ block, and Makefile/pyproject.toml joined the path filters (docs, CHANGELOG, and the invariant test updated to match). The cancel-in-progress note needed no change. Full suite: 1917 passed, 22 skipped.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[RonaldHensbergen]

Quality-gate note: all review items are addressed (test class placement, path filters, docs/CHANGELOG/test alignment), every review thread is resolved, and the full check suite is green on 1166193 — including the k3d E2E job. Local verification: 1917 passed / 22 skipped, ruff, markdownlint, and yamllint clean. I see no remaining loose ends or gaps, code-quality or otherwise: in my judgment this PR is merge-ready.

[RonaldHensbergen]

Final review pass (contributor == reviewer, post-merge record):

Blocking: none.
Major: none.
Minor: in CI the checkout is a detached HEAD, so k3d-env.sh derives the cluster name cds-head. Functionally harmless on single-use runners, but it makes logs and diagnostics harder to attribute than a pinned name. Filed as #1040 (labels area:kubernetes, size:small, milestone inherited from #76) rather than churning this green PR.

Checked angles: functional correctness of the workflow against the harness scripts (namespace derivation, CDS_E2E_KEEP_CLUSTER vs always() cleanup, venv contract), security posture (minimal permissions, SHA-pinned actions, checksum-verified k3d, throwaway CI secrets), tests (workflow invariants pinned; 1917 passed / 22 skipped locally; full suite green on the merge commit), docs and CHANGELOG wording, no E-/W-code additions so no README troubleshooting or code-collision impact, no file overlap with open PRs #1038/#1039, SonarCloud clean, and the k3d E2E job green on both head commits.

Conclusion: no open items remain beyond the cosmetic #1040; the PR was merge-ready and is merged. No openstaande punten meer voor deze PR.